import libica-4.1.1-2.el8

This commit is contained in:
CentOS Sources 2023-03-28 09:22:55 +00:00 committed by Stepan Oksanichenko
parent a80204a907
commit 2895cffc24
5 changed files with 100 additions and 17 deletions

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/libica-4.0.2.tar.gz SOURCES/libica-4.1.1.tar.gz

View File

@ -1 +1 @@
a9137e070966cefc5a2078893edc4693ee62088f SOURCES/libica-4.0.2.tar.gz a826ac86ded4ed96804fe19634b02838ab78ac86 SOURCES/libica-4.1.1.tar.gz

View File

@ -1,7 +1,7 @@
From 2fff02190269bc3a1b5bb1f7d721fffb9aabe1e7 Mon Sep 17 00:00:00 2001 From 2945363230c1d76d21327e12995a8789ec9df514 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz> From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
Date: Tue, 22 Mar 2022 12:43:19 +0100 Date: Tue, 22 Mar 2022 12:43:19 +0100
Subject: [libica PATCH] Revert "Remove deprecated API functions" Subject: [libica PATCH 1/2] Revert "Remove deprecated API functions"
This reverts commit 4a3a77232ee85cf9f4eb7ac2d366b613013b9048. This reverts commit 4a3a77232ee85cf9f4eb7ac2d366b613013b9048.
--- ---
@ -23,10 +23,10 @@ This reverts commit 4a3a77232ee85cf9f4eb7ac2d366b613013b9048.
create mode 100644 test/tdes_test.c create mode 100644 test/tdes_test.c
diff --git a/include/ica_api.h b/include/ica_api.h diff --git a/include/ica_api.h b/include/ica_api.h
index 6137c4a..e00103e 100644 index 0263d2f..8f7bbdb 100644
--- a/include/ica_api.h --- a/include/ica_api.h
+++ b/include/ica_api.h +++ b/include/ica_api.h
@@ -1403,6 +1403,227 @@ unsigned int ica_rsa_crt(ica_adapter_handle_t adapter_handle, @@ -1447,6 +1447,227 @@ unsigned int ica_rsa_crt(ica_adapter_handle_t adapter_handle,
ICA_EXPORT ICA_EXPORT
unsigned int ica_rsa_crt_key_check(ica_rsa_key_crt_t *rsa_key); unsigned int ica_rsa_crt_key_check(ica_rsa_key_crt_t *rsa_key);
@ -254,7 +254,7 @@ index 6137c4a..e00103e 100644
/** /**
* Encrypt or decrypt data with an DES key using Electronic Cook Book (ECB) * Encrypt or decrypt data with an DES key using Electronic Cook Book (ECB)
* mode as described in NIST Special Publication 800-38A Chapter 6.1. * mode as described in NIST Special Publication 800-38A Chapter 6.1.
@@ -3379,6 +3600,15 @@ void ica_aes_gcm_kma_ctx_free(kma_ctx* ctx); @@ -3485,6 +3706,15 @@ void ica_aes_gcm_kma_ctx_free(kma_ctx* ctx);
ICA_EXPORT ICA_EXPORT
unsigned int ica_get_version(libica_version_info *version_info); unsigned int ica_get_version(libica_version_info *version_info);
@ -271,7 +271,7 @@ index 6137c4a..e00103e 100644
* Function that returns a list of crypto mechanisms supported by libica. * Function that returns a list of crypto mechanisms supported by libica.
* @param pmech_list * @param pmech_list
diff --git a/libica.map b/libica.map diff --git a/libica.map b/libica.map
index 0d031e1..e74092e 100644 index 0a64d4c..0a71832 100644
--- a/libica.map --- a/libica.map
+++ b/libica.map +++ b/libica.map
@@ -3,11 +3,15 @@ LIBICA_3.0.0 { @@ -3,11 +3,15 @@ LIBICA_3.0.0 {
@ -309,10 +309,10 @@ index 0d031e1..e74092e 100644
ica_aes_cbc; ica_aes_cbc;
ica_aes_cbc_cs; ica_aes_cbc_cs;
diff --git a/src/ica_api.c b/src/ica_api.c diff --git a/src/ica_api.c b/src/ica_api.c
index a10e139..c3a6343 100644 index 42d9baf..3e13a29 100644
--- a/src/ica_api.c --- a/src/ica_api.c
+++ b/src/ica_api.c +++ b/src/ica_api.c
@@ -2378,6 +2378,264 @@ int ica_ed448_key_gen(ICA_ED448_CTX *ctx) @@ -2436,6 +2436,264 @@ int ica_ed448_key_gen(ICA_ED448_CTX *ctx)
* *
******************************************************************************/ ******************************************************************************/
@ -594,7 +594,7 @@ index 49cbb09..76f530f 100644
#if defined(OPENSSL_VERSION_MAJOR) && defined(OPENSSL_VERSION_MINOR) #if defined(OPENSSL_VERSION_MAJOR) && defined(OPENSSL_VERSION_MINOR)
#define OPENSSL_VERSION_PREREQ(maj, min) \ #define OPENSSL_VERSION_PREREQ(maj, min) \
diff --git a/test/Makefile.am b/test/Makefile.am diff --git a/test/Makefile.am b/test/Makefile.am
index d1e5a09..11ed749 100644 index f220205..f756597 100644
--- a/test/Makefile.am --- a/test/Makefile.am
+++ b/test/Makefile.am +++ b/test/Makefile.am
@@ -7,16 +7,21 @@ get_version_test \ @@ -7,16 +7,21 @@ get_version_test \
@ -619,7 +619,7 @@ index d1e5a09..11ed749 100644
aes_ecb_test \ aes_ecb_test \
aes_cbc_test \ aes_cbc_test \
aes_ctr_test \ aes_ctr_test \
@@ -70,10 +75,10 @@ get_functionlist_cex_test_SOURCES = get_functionlist_cex_test.c @@ -71,10 +76,10 @@ get_functionlist_cex_test_SOURCES = get_functionlist_cex_test.c
get_functionlist_cex_test_LDADD = @LIBS@ ${top_builddir}/src/.libs/libica-cex.so -lcrypto -lpthread get_functionlist_cex_test_LDADD = @LIBS@ ${top_builddir}/src/.libs/libica-cex.so -lcrypto -lpthread
check_PROGRAMS = fips_test icastats_test get_functionlist_test \ check_PROGRAMS = fips_test icastats_test get_functionlist_test \
@ -1578,5 +1578,41 @@ index 0000000..bfa33c2
+} +}
+ +
-- --
2.34.1 2.38.1
From 740531ec03c7dd79e185136b0b1970aa1cd1d924 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
Date: Tue, 25 Oct 2022 13:54:11 +0200
Subject: [libica PATCH 2/2] add back fips_check_3des_key()
Partially revert 56b9ac0669e4d204ecb3f23e5404c2351cca96a2 by adding back
a function that's required by the previously reverted code.
---
src/ica_api.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/src/ica_api.c b/src/ica_api.c
index 3e13a29..1bd81bb 100644
--- a/src/ica_api.c
+++ b/src/ica_api.c
@@ -91,6 +91,16 @@ void ica_set_stats_mode(int stats_mode)
}
#ifndef NO_CPACF
+#ifdef ICA_FIPS
+static unsigned int fips_check_3des_key(const ica_des_key_triple_t *key) {
+ if (!CRYPTO_memcmp(key->key1, key->key2, DES_KEY_LEN64)
+ | !CRYPTO_memcmp(key->key1, key->key3, DES_KEY_LEN64)
+ | !CRYPTO_memcmp(key->key2, key->key3, DES_KEY_LEN64))
+ return EINVAL;
+
+ return 0;
+}
+#endif
static unsigned int check_des_parms(unsigned int mode,
unsigned long data_length,
--
2.38.1

View File

@ -0,0 +1,35 @@
From cd5b2b75554875111bf375b555ebd3b185cff1a0 Mon Sep 17 00:00:00 2001
From: Joerg Schmidbauer <jschmidb@de.ibm.com>
Date: Wed, 1 Feb 2023 10:54:33 +0100
Subject: [libica PATCH] bugfix: permission denied on shared memory segments
A change to the Linux kernel in 4.19 for added security is
changing the behavior when opening shared memory segments.
The O_CREAT flag must not be used for existing segments.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
---
src/icastats_shared.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/icastats_shared.c b/src/icastats_shared.c
index bbc8d0e..8290239 100644
--- a/src/icastats_shared.c
+++ b/src/icastats_shared.c
@@ -54,9 +54,10 @@ int stats_mmap(int user)
sprintf(shm_id, "icastats_%d",
user == -1 ? geteuid() : (uid_t)user);
- stats_shm_handle = shm_open(shm_id,
- O_CREAT | O_RDWR,
- S_IRUSR | S_IWUSR);
+ stats_shm_handle = shm_open(shm_id, O_RDWR, S_IRUSR | S_IWUSR);
+
+ if (stats_shm_handle == -1)
+ stats_shm_handle = shm_open(shm_id, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
if (stats_shm_handle == -1)
return rc;
--
2.39.1

View File

@ -4,8 +4,8 @@
Summary: Library for accessing ICA hardware crypto on IBM z Systems Summary: Library for accessing ICA hardware crypto on IBM z Systems
Name: libica Name: libica
Version: 4.0.2 Version: 4.1.1
Release: 1%{?dist} Release: 2%{?dist}
License: CPL License: CPL
Group: System Environment/Libraries Group: System Environment/Libraries
URL: https://github.com/opencryptoki/ URL: https://github.com/opencryptoki/
@ -14,8 +14,12 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{v
# https://bugzilla.redhat.com/show_bug.cgi?id=1630582 # https://bugzilla.redhat.com/show_bug.cgi?id=1630582
Patch0: %{name}-4.0.1-annotate.patch Patch0: %{name}-4.0.1-annotate.patch
# revert ABI to 3.x # revert ABI to 3.x
# reverted commit 4a3a77232ee85cf9f4eb7ac2d366b613013b9048 # - reverted commit 4a3a77232ee85cf9f4eb7ac2d366b613013b9048
Patch1: %{name}-4.0.1-revert-abi.patch # - partial revert of commit 56b9ac0669e4d204ecb3f23e5404c2351cca96a2
Patch1: %{name}-4.1.1-revert-abi.patch
# fix permissions for shared memory segments
# https://bugzilla.redhat.com/show_bug.cgi?id=2167363
Patch2: %{name}-4.1.1-shmem.patch
BuildRequires: gcc BuildRequires: gcc
BuildRequires: openssl BuildRequires: openssl
BuildRequires: openssl-devel BuildRequires: openssl-devel
@ -106,6 +110,14 @@ fi
%changelog %changelog
* Tue Feb 07 2023 Dan Horák <dhorak@redhat.com> - 4.1.1-2
- fix permissions for shared memory segments (#2167363)
- Resolves: #2167363
* Tue Oct 25 2022 Dan Horák <dhorak@redhat.com> - 4.1.1-1
- updated to 4.1.1 (#2110375)
- Resolves: #2110375
* Thu Jun 30 2022 Dan Horák <dhorak@redhat.com> - 4.0.2-1 * Thu Jun 30 2022 Dan Horák <dhorak@redhat.com> - 4.0.2-1
- updated to 4.0.2 (#2101766) - updated to 4.0.2 (#2101766)
- Resolves: #2101766 - Resolves: #2101766